Risk = impact x likelihood The proper flow would be: determine the scope of the problem. determine the assessment: threat sources, vulnerabilities, impact, likelyhood communicate results maintain understanding of risk